On Friday, I blogged about “Project Sundance”, which is an upcoming release from the Solution Accelerators team that combines the Vista/XP/2003/2008/Office security guides with the Configuration Manager Desired Configuration Management (DCM) packs for security, along with the GPOAccelerator tool into one package.
Boy, that rolled right off the tongue. There’s a reason why I’m not in marketing, but as a security geek this really is the bee’s knees.
In short, if you want to setup, deploy, and monitor a security baseline for your network, Project Sundance is for you.
Anyhoo…
Project Sundance is currently in beta, and the development team is holding a LiveMeeting on Wednesday from 11AM – Noon PST to demo the toolkit and get feedback on how they can make it work better for you. So, be there or be square. I have it blocked on my calendar :)
Sign up for the event here: http://msevents.microsoft.com/CUI/InviteOnly.aspx?EventID=BB-58-A0-C3-FF-FA-47-36-95-02-66-D2-6C-86-A1-73&culture=en-US
This event is by invitation only. However, I am inviting you. Tell ‘em Sean sent you :).
Invitation Code : BEA304
Bonus points: I don’t know what they are planning on calling the final product, but if you have a suggestion that is better than Microsoft Security-guides-along-with-Config-Manager-DCM-packs-and-GPOAccelerator-Toolkit-SP1 R2 2009, let me know and I’ll forward your suggestion to the team :)
SharePoint and Office go together like peanut butter and chocolate, like Captain & Tennille, like bees and honey. Despite using SharePoint to hold and version my documents for the last year or so, I have somehow completely overlooked an AWESOME feature. If you are not using it yet, give it a shot.
SharePoint Collect Feedback workflow
Why is it that I store documents (nicely versioned) in a document library, but revert to e-mail attachments when gathering feedback? I end up with a full inbox and multiple copies of the same document, all with different suggestions. I also end up with those people that will just not give feedback (they save the complaints for after the document has been finalized and published.
(*note, the cool artsy graphics below are shamelessly stolen from the Training presentation: SharePoint Server 2007—Workflows II: Collect feedback for a file). Screenshots are (mostly) mine.
The collect feedback workflow sends a task to all reviewers with a link to the document, requires the document to be checked-out for changes to be made (so you have one version of the truth), sends reminders, and lets you see who has (or has not) provided feedback.
Before you start the workflow, make sure that you have enabled “Track Changes” on your document so that reviewers can add comments and you can see what changes were made by which person. You will also want to make sure that the reviewers have “contribute” permissions to the document library, or they will not be able to make changes.
You can kick off the workflow one of two ways… from the Document Library, click on the drop-down menu for the document, and choose Workflows, then “Collect Feedback”
Alternatively, open the document directly from the document library (it must be checked in to start the workflow), click on the Office Pearl and choose Workflows, and then Start the “Collect Feedback” workflow.
You can then add the reviewers who will receive a task to provide feedback on the document, and can also set a due date (after which SharePoint will send reminder emails if they have not provided feedback).
You can also track the status of the workflow and tasks, and add or update reviewers.
Reviewers will have to check out the document to work on it, and can change the status of their task to “complete” once they are done reviewing the document and providing feedback.
Resources:
If you are in charge of maintaining the security baseline at your company, you know that there are two key problems you face. First of all, there are a LOT of security settings to tweak within Windows. The services you harden and lock down on a Domain Controller are very different from those that you harden on a Web Server. We’ve provided some excellent and comprehensive recommendations in the following guides:
The other problem is that security settings can drift away from the baseline over time as you install additional software, disable certain security features for troubleshooting purposes, etc.
Enter Project Sundance from the Solution Accelerator team. It includes Security Baseline Toolkits for Office 2007, Windows Server 2003 and 2008, as well as Windows Vista and XP. The toolkits contain the relevant Security Guide, along with the recommended baseline security settings in a file that can be rapidly turned into Group Policy objects and pushed out to clients in your domain through the GPOAccelerator tool.
How easy? I can show you in screenshots :)
And here is what you end up with.
There are some other goodies that come along with Project Sundance. You get an Attack Surface Reference spreadsheet which lets you know what files, services, ports, and role dependencies are involved with each role (Web, Directory Services, DNS Server, etc).
The toolkit also comes with 18 Configuration Packs to use with the desired configuration management feature of Configuration Manager 2007 SP1. This monitoring capability helps to ensure that your security baselines do not change or drift from their prescribed values.
So… A lot of moving pieces, and Project Sundance can help you stay on top of them. Project Sundance is in beta, and the Solution Accelerator team is looking for feedback, so head on over to the connect site to join the Beta.
Wow… not sure how I missed this (especially as Scott covered it recently)! A perfect companion to the Microsoft Web Platform Installer is the Web Application Installer. Whereas the former installs and configures all of the plumbing (SQL, IIS, .Net, etc), the Web Application Installer installs the web applications that run on top. From the site:
Overview The Web Application Installer Beta is designed to help get you up and running with the most widely used Web Applications freely available for your Windows Server. Web AI provides support for popular ASP.Net and PHP Web applications including Graffiti, DotNetNuke, WordPress, Drupal, OSCommerce and more. With just a few simple clicks, Web AI will check your machine for the necessary pre-requisites, download these applications from their source location in the community, walk you through basic configuration items and then install them on your computer. System requirements You must have administrator privileges on your computer to run Web Application Installer Beta. Supported Operating Systems are: Windows Vista SP1 or Windows Server 2008. Supported Architectures: x86 and 64-bit. Run the Web Platform Installer before you get started to get your platform (IIS,ASP.NET, SQL, and more) components installed. Many applications also require PHP and MySQL to get started. To install PHP, go here. To install MySQL, go here.
The Web Application Installer Beta is designed to help get you up and running with the most widely used Web Applications freely available for your Windows Server. Web AI provides support for popular ASP.Net and PHP Web applications including Graffiti, DotNetNuke, WordPress, Drupal, OSCommerce and more. With just a few simple clicks, Web AI will check your machine for the necessary pre-requisites, download these applications from their source location in the community, walk you through basic configuration items and then install them on your computer.
Very cool! Get it here: http://www.microsoft.com/web/channel/products/WebApplicationInstaller.aspx
Scott Hanselman has already done a good job of covering it, but if you do any sort of web development, you know it can be a pain in the butt to download, install, and configure all of the necessary components (Visual Studio 2008, SQL Server 2008, IIS, etc). The new Web Platform Installer is an awesome tool that downloads and installs everything for you. From the site:
Overview The Web Platform Installer (Web PI) is a simple tool that installs Microsoft's entire Web Platform, including IIS, Visual Web Developer 2008 Express Edition, SQL Server 2008 Express Edition and the .NET Framework. Using the Web Platform Installer’s user interface, you can choose to install either specific products or the entire Microsoft Web Platform onto your computer. The Web PI also helps keep your products up to date by always offering the latest additions to the Web Platform. New Updates! Now supporting Windows XP and Windows Server 2003, Web PI makes it easy to install and stay up-to-date with the Microsoft Web Platform. This updated release lets you install ASP.NET MVC, Visual Studio Tools for Silverlight, and much more! System requirements Supported Operating Systems are: Windows Vista RTM, Windows Vista SP1, Windows XP, Windows Server 2003, Windows Server 2008 You must have administrator privileges on your computer to run Web Platform Installer .NET 2.0 Framework Supported Architectures: x86 and 64-bit
The Web Platform Installer (Web PI) is a simple tool that installs Microsoft's entire Web Platform, including IIS, Visual Web Developer 2008 Express Edition, SQL Server 2008 Express Edition and the .NET Framework. Using the Web Platform Installer’s user interface, you can choose to install either specific products or the entire Microsoft Web Platform onto your computer. The Web PI also helps keep your products up to date by always offering the latest additions to the Web Platform.
New Updates! Now supporting Windows XP and Windows Server 2003, Web PI makes it easy to install and stay up-to-date with the Microsoft Web Platform. This updated release lets you install ASP.NET MVC, Visual Studio Tools for Silverlight, and much more!
I am going to try to teach myself web development in my copious spare time, so this installer is a really nice way to get all of the prerequisite software up and running.
Get it here: http://www.microsoft.com/web/channel/products/WebPlatformInstaller.aspx
If you have played with the Zune 3.0 software and let it sit for a few minutes, you’ve probably seen the cool new “Now Playing” screens that come up with pictures of the artists, their bios, playcounts, etc.
If are impatient and don’t want to wait for the screen to come up, you can make it happen. Just click either place indicated below.
Looks like I’m going buck-wild with the Zune stuff today :)
With my Zune Pass, I can download as many songs from as many artists as I would like. That’s great for filling up my Zune, but in the end you want to be able to kick back and listen to some great tunes. While some people like listening to individual albums, I enjoy having a nice mix.
If you are in 9th grade and making a CD for the cute girl in homeroom, it’s okay to do it manually, but I like to use the autoplaylist feature of Zune.
In the bottom-left of the Zune software, hover over the icon that looks like a list, and choose “New autoplaylist”.
You can now select from a TON of criteria. You can add multiple artists, have it only add songs you like or haven’t rated, include or exclude certain Genres, only include songs you added recently, with a certain number of plays…
The options are pretty limitless!
What songs and artists do you have in your Zune autoplaylist?
Huge collection of wallpaper/backgrounds for your Zune.
http://www.zune.net/en-us/mp3players/backgrounds/default.htm
When the Zune 120 was released a few months ago, I picked one up to replace my iPod, and I haven’t looked back. I absolutely LOVE it. The only thing that could possibly make it better is if the Zune team released it in some color other than black.
Well… now that I have spent my discretionary music player budget for the year, guess what was announced today?
Blue. And Red.
Damn.
I guess that’s what happens when you live on the cutting edge.
You can buy (and personalize) one here: http://www.zuneoriginals.net
While we’re Zuning it up here, make sure to pick up your free Zune Pass to get 14 days of free music.
Just released, and only weighing in at 490 pages. You didn’t have anything better to do over the Thanksgiving weekend, did you? ;)
Get it here.
Brief Description
This 490-page document covers the essential phases and steps to upgrade existing instances of SQL Server 2000 and 2005 to SQL Server 2008 by using best practices. These include preparation tasks, upgrade tasks, and post-upgrade tasks. It is intended to be a supplement to SQL Server 2008 Books Online.
Overview
A successful upgrade to SQL Server 2008 should be smooth and trouble-free. To achieve that smooth transition, you must devote plan sufficiently for the upgrade, and match the complexity of your database application. Otherwise, you risk costly and stressful errors and upgrade problems. Like all IT projects, planning for every contingency and then testing your plan gives you confidence that you will succeed. But if you ignore the planning process, you increase the chances of running into difficulties that can derail and delay your upgrade. This document covers the essential phases and steps involved in upgrading existing SQL Server 2000 and 2005 instances to SQL Server 2008 by using best practices. These include preparation tasks, upgrade tasks, and post-upgrade tasks.
I was just reading through the SQL Server 2008 Compliance Guide that was just released, and it actually has some great information on taking advantage of the new features as part of your GRC program. Transparent encryption, policy-based management, auditing reports… good stuff!
I know I have fallen woefully behind in my blogging… for some reason I thought it would be a good idea to sign up for 18 college credits while working full time, which has left me precious little time for things I once enjoyed, like blogging, sleep, or remembering my kid’s names.
Good times.
In any case, I just threw my blog RSS feed at Wordle, which created the awesome image below. I wonder what types of things I’m interested in? ;)
When browsing around on the Internet today, I ended up on one of those “your computer is running slow, you should buy my fake speeder-upper program!” sites.
This particular site has decided that registry errors cause all sorts of problem, including (but not limited to) HARDWARE FAILURE WITH YOUR IPOD OR SPEAKERS.
How is this even legal?!?!?
Good grief…
On a nuclear submarine, it takes two keys to initiate the launch of a nuclear missile (if movies like Hunt for the Red October are to be believed). At Microsoft, it looks like we use THREE cards to allow access to our Public Key Infrastructure.
Microsoft IT created security worlds with administrative card sets composed of six smart cards, any three of which were required to perform administrative functions. The administrative cards were needed whenever a new CA was brought online and added to the associated security world. Two cards were distributed to the Legal and Corporate Affairs department, two others were distributed to a separate internal auditing team, and the final two were retained by the IT Security team in Microsoft IT. The requirement of three smart cards provided role separation and guaranteed that performing such high-level functions required the involvement of members from at least two of these three groups.
Great approach for protecting against a rogue administrator, but probably overkill for a PKI deployment at Joe’s Crab Shack. Great whitepaper if you are interested in reading about a real-world large PKI implementation.
Read Here: IT Showcase: Deploying PKI Inside Microsoft
In my Inbox today from (ISC)2:
Congratulations! It gives me great pleasure to be the first to address you with the Certified Information Systems Security Professional (CISSP®) designation! Based upon your examination results, a review of your application and acceptance of your endorsement, the (ISC)2 Board of Directors awarded you with the CISSP designation.
Congratulations! It gives me great pleasure to be the first to address you with the Certified Information Systems Security Professional (CISSP®) designation!
Based upon your examination results, a review of your application and acceptance of your endorsement, the (ISC)2 Board of Directors awarded you with the CISSP designation.
Yaaay! :)
It looks like the Threats and Countermeasures guide has been updated for Windows Vista.
This guide is a reference to security settings that provide countermeasures for specific threats against current versions of the Windows® operating systems. This guide is a companion for two other publications that are available from Microsoft: Windows Server 2003 Security Guide Windows Vista Security Guide Many of the countermeasures that are described in this guide are not intended for specific computer roles in the companion guides, or in some cases for any roles at all. These countermeasures help ensure compatibility, usability, manageability, availability, or performance. Generally, as security increases, functionality decreases, and vice versa. However, there are exceptions, and some security countermeasures actually help to improve functionality. Each section begins with a brief explanation of what is in the section, followed by a list of subsection headers, each of which corresponds to a setting or group of settings. Each subsection includes a brief explanation of what the countermeasure does, and includes the following three additional subsections: Vulnerability. Explains how an attacker might exploit a feature or its configuration. Countermeasure. Explains how to implement the countermeasure. Potential impact. Explains the possible negative consequences of countermeasure implementation.
This guide is a reference to security settings that provide countermeasures for specific threats against current versions of the Windows® operating systems.
This guide is a companion for two other publications that are available from Microsoft:
Many of the countermeasures that are described in this guide are not intended for specific computer roles in the companion guides, or in some cases for any roles at all. These countermeasures help ensure compatibility, usability, manageability, availability, or performance.
Generally, as security increases, functionality decreases, and vice versa. However, there are exceptions, and some security countermeasures actually help to improve functionality.
Each section begins with a brief explanation of what is in the section, followed by a list of subsection headers, each of which corresponds to a setting or group of settings. Each subsection includes a brief explanation of what the countermeasure does, and includes the following three additional subsections:
This guide consists of seven sections that provide a reference to the settings that you should consider while planning the security policy for your organization.
Domain Level Account Policies discusses the Group Policy settings that are applied at the domain level: password policies, account lockout policies, and Kerberos authentication protocol policies. Collectively, these policies are referred to as account policies.
Audit Policy discusses the use of audit policies to monitor and enforce your security measures. It describes the various settings and provides examples of how audit information is modified when the settings are changed.
User Rights discusses the various logon rights and privileges that are provided by the Windows operating systems and provides guidance about which accounts should be assigned these rights.
Security Options discusses the security settings for digital data signatures, Administrator and Guest account names, access to floppy disk and CD-ROM drives, driver installation behavior, and logon prompts.
Event Log discusses how to configure the settings that relate to the various event logs on computers running Windows Server 2003 or Windows Vista.
System Services describes the services that are included withWindows Vista and Windows Server 2003. Many of these services are configured to run by default, but others are not present unless you install specific components.
Software Restriction Policies provides a brief overview of the software restriction policy mechanism used in Windows Vista and Windows Server 2003. It provides links to additional resources about how to design and use software restriction policies.
Additional System Countermeasures describes a number of additional security measures that may need to be applied to your computers. However, these countermeasures cannot be easily applied through Group Policy or other automated means. These countermeasures include securing accounts on member servers, NTFS settings, data and application segmentation, SNMP community name settings, disabling NetBIOS bindings, Terminal Services configuration, Dr. Watson, and IPsec policies. A short overview on Windows Firewall is also provided along with a pointer to more extensive guidance on Windows Firewall that you should review if your organizational security policy includes Windows Firewall settings.
Additional Registry Entries provides information about additional registry entries that should be considered in configuring your overall security policy.
Additional Resources provides links to additional information sources about Windows security subjects from Microsoft that you may find useful.
If you have any need to find out what your computer is really doing under the hood, you know that Process Monitor is the tool. Today, Process Monitor 2.0 was released. From the Sysinternals blog:
This major update to Process Monitor adds real-time TCP and UDP monitoring to its existing process, thread, DLL, file system and registry monitoring. You can now see the TCP and UDP activity processes performed, including the operation (e.g. connect, send, receive), local and remote IP addresses and DNS names, and operation transfer lengths. On Windows Vista, Process Monitor also collects thread stacks for network operations.
Download here: http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
As before, Process Monitor includes:
And now, for some screenshots to whet your appetite.
Fun compile of a lengthy thread on an internal discussion list (thanks Eric!) :)
You might be a PM if…
Free eBook available here: http://csna01.libredigital.com/?urss1q2we6
Learn about major new features in SQL Server 2008 including security, administration, and performance.
Introducing Microsoft SQL Server 2008: Chapter 1: Security and Administration Chapter 2: Performance Chapter 3: Type System Chapter 4: Programmability Chapter 5: Storage Chapter 6: Enhancements for High Availability Chapter 7: Business Intelligence Enhancements
Calories in a Moose
http://search.live.com/results.aspx?q=calories+in+a+moose&form=QBRE
MSFT AAPL GOOG quote
You can get quotes on multiple stocks at the same time with the results in a table
http://search.live.com/results.aspx?q=MSFT+AAPL+GOOG+quote&form=QBRE
Birth rate in Uganda
http://search.live.com/results.aspx?q=birth+rate+in+uganda&form=QBRE
Useful when working on that 5th grade Social Studies project. You can do other stuff such as literacy rate, area, capital, GDP, population growth/density, infant mortality rate, population per physician, etc. Basically, anything :)
Where the hell am I
http://search.live.com/results.aspx?q=Where+the+hell+am+I&form=QBRE
(Note... this feature depends on your IP address to properly geolocate. If you use a large ISP it may locate you in some funky place :)
Define:eccentric
http://search.live.com/results.aspx?q=define%3Aeccentric&form=QBLH
intitle:rescue package
http://search.live.com/results.aspx?q=Intitle%3Arescue+package&form=QBRE
Not to mention our landing page is the prettiest one by far (and the picture changes every day)
http://www.live.com
If you haven’t downloaded the new Zune 3.0 software, you really should give it a try (you don’t even need the Zune hardware to use the software, and it really is a slick piece of software).
I am a fan of listening to new music that I’ve never heard, and had been using the Genius feature of iTunes 8 to create playlists of music I’d like to try. However, I am finding that the “Social” aspect of the Zune software allows me to find music recommendations from other people with similar tastes, which is working better for me than Apple’s Algorithm In The Sky (which can give some pretty crazy recommendations). Couple the Zune Social (and Channels, and Mix View) with the all-you-can-eat Zune Pass subscription, and you are in new-music heaven.
If only there were a way to try that Zune-Pass before you buy.
Looking on the Zune site today, I see they have added a 14-day trial of Zune Pass for free. Good deal! I am downloading 80 songs as we speak :) From the site:
Already have a Zune account? If you don't have Zune 3.0 software, click here to upgrade. Click here to sign into your account. Click here to go to your account management page. Click Zune Pass. Fill in your contact information, select "Zune 14-day Trial Pass, Price $0.00," and input your credit card billing information.* Click here to launch Zune Marketplace and start enjoying Zune Pass. New to Zune? Click here to sign up for a Zune account and download the free Zune 3.0 software. Click here to go to your account management page. Click Zune Pass. Fill in your contact information, click Next, select "Zune 14-day Trial Pass, Price $0.00," click Next, and input your credit card billing information.* Click here to launch Zune Marketplace and start enjoying Zune Pass. * Your credit card will not be billed. This is a free trial.
Already have a Zune account?
New to Zune?
* Your credit card will not be billed. This is a free trial.
The darndest things show up on the Microsoft Download Center. If you’ve been looking for some posters to raise excitement about your upcoming Office 2007 deployment… then you’ll want to hit up the Office 2007 IW Excitement Posters. From the description:
This is a collection of 6 posters designed to be used by Microsoft customers to post around their facility during Office 2007 deployment. The posters highlight the end-user attention-grabbing features that will get people interested in and excited about the new version. There are a set of low resolution versions to look at and to email to customers, as well as a set of high resolution versions suitable for printing at poster sizes. There is also a version which includes an editable spot for customers to insert their own logos.
Seriously though… Office 2007 is the bees knees.
It looks like this month’s TechNet Magazine is going buck-wild on Virtualization.
An Introduction to Hyper-V in Windows Server 2008
The introduction of Hyper-V makes virtualization an even more compelling solution for IT environments. Get an overview of today’s virtualization market and see how Hyper-V improves the manageability, reliability, and security of virtualization Rajiv Arunkundram
Manage Your Virtual Environments with VMM 2008
System Center Virtual Machine Manager provides a consolidated interface for managing your virtual infrastructure. The latest version adds support for Windows Server 2008 Hyper-V, as well as for VMware virtual machines. Explore the new features and get an overview of using VMM to centralize your management tasks. Edwin Yuen
Getting Started with Microsoft Application Virtualization
Microsoft Application Virtualization (App-V) allows you to deliver virtualized desktops to client systems throughout your organization. This simplifies system management and liberates employees from their desktops. Take a close look at how App-V works and discover how you can deploy it in your organization. Anthony Kinney
Achieving High Availability for Hyper-V
Consolidating servers onto fewer physical machines has many advantages, but it is extremely important that you plan for your systems to be highly available. Here’s a guide to using Windows Server 2008 Failover Clustering to bring high availability to your Hyper-V virtual machines. Steven Ekren
Backup and Disaster Recovery for Server Virtualization
Virtualization brings significant changes to disaster recovery. Here’s an introduction to how the Microsoft virtualization platform factors into your disaster recovery plan, as well as a deeper look into backup and restore options and considerations for Windows Server 2008 Hyper-V. Adam Fazio
Essential Tools for Planning Your Virtual Infrastructure
Is your infrastructure ready for virtualization? The Microsoft Assessment and Planning Toolkit, a network-wide infrastructure assessment tool, can help you better understand your IT infrastructure and determine whether your systems are ready for upgrade or migration to a variety of technologies, including virtualization. Jay Sauls and Baldwin Ng
Offline Virtual Machine Servicing Tool
Virtual machines that are stored offline don’t automatically receive the necessary updates to keep them safe and compliant. This, in turn, can pose a risk to your entire IT environment. Find out how the free Offline Virtual Machine Servicing Tool lets you automate the process of updating virtual machines. Peter Skjøtt Larsen and Suveen Kumar Reddy Vuppala
Okay... here's the deal. My team is hiring. This is a limited-time, clock-is-ticking, once-in-a-lifetime opportunity to work at an awesome job for an awesome team at an awesome company. (Did I cover how I feel about this position yet?)
Here's what we are looking for:
Travel is minimal as this is a phone-based role out of Issaquah, WA. The work environment is relaxed, and in two years I have not had to work a single week-end. This is a full-time, blue-badge deal.
In short, my team provides technical advisory services to Microsoft Partners who are working on projects to implement Microsoft technologies. We provide best practices and guidance to the partners so that their deployments are successful the first time, every time.
If you are interested, ping me at: sean dot earp at microsoft dot com and I'll fill you in on the details.
Get it here: http://www.zune.net/en-us/products/zunesoftware/download.htm
My favorite new feature? Support for audiobooks through Audible and Overdrive (your local library likely has audiobooks that you can download and listen to on your Zune). Awesome for commuting! The "buy from FM" feature is pretty sweet as well...
So what is new?
Zune has partnered with high-speed Internet access provider Wayport to let customers wirelessly shop Zune Marketplace on their player at more than 9,800 McDonald's restaurants across the U.S.
http://www.zune.net